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Listing of Claims 

Claim 1 (original) A method for identifying a flow of data between a source and a 
destination in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the network; 

comparing a source address of each packet identified at the second point with one or 
more source addresses of packets identified at the first point; and 

if one of the compared source addresses matches, identifying a destination address of 
the corresponding packet identified at the second point, and associating the identified 
destination address and the matching source address to a flow between the source and 
destination. 

Claim 2 (original) A method for identifying a flow of data between a source and a 
destination in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the network; 

comparing a destination address of each packet identified at the first point with one 
or more destination addresses of packets identified at the second point; and 

if one of the compared destination addresses matches, identifying a source address of 
the corresponding packet identified at the first point, and associating the identified source 
address and the matching destination address to a flow between the source and destination. 

Claim 3 (currently amended) The method of claim 2, wherein the step of identifying a 
plurality of packets at the second point further comprises the steps-step of generating a 
compressed address group based on the destination address of each packet identified at the 
second point. 

Claim 4 (currently amended) The method of claim 3, wherein generating the compressed 
address group comprises the steps of ; 

identifying network addresses based on the destination addresses identified at the 
second point; and 

classifying each identified network address based on a range of bits in the identified 
network addresses. 

Claim 5 (currently amended) The A method of claim 3 for identifying a flow of data 
between a source and a destination in a network, said method comprising the steps of; 
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identifying a plurality of packets at a first point and a second point in the network, 
said step of identifying a plurality of packets at the second point in the network 
comprising generating a compressed address group based on the destination address of each 
packet identified at the second point .wherein generating the compressed address group 
comprises identifying network addresses for the packets identified at the second point and, if 
the identified network addresses of two of the packets identified at the second point differ by 
a least a significant bit, then generating a compressed address by combining the identified 
addresses of the two packets; 

comparing a destination address of each packet identified at the first point with one 
or more destination addresses of packets identified at the second point: 

if one of the compared destination addresses matches, identifying a source address of 
the corresponding packet identified at the first point and associating the 
identified source address and the matching destination address to a flow between the source 
and destination. 

Claim 6 (currently amended) The A method of claim 3 for identifying a flow of data 
between a source and a destination in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point, said step of 
identifying a plurality of packets at the s econd point in the network comprising generating a 
compressed address group based on the destination address of each packet identified at the 
second point: and 

if one of the compared destination addresses matches, identifying a source address of 
the corresponding packet identified at the first point, and associating the identified source 
address and the matching destination address to a flow between the source and destination; 
and 

wherein generating the compressed address group comprises: 

identifying network addresses based on the destination address identified at the 
second point; 

classifying each identified network address based on a range of bits in the identified 
network addresses; and 

if the identified network addresses of two of the packets identified at the second 
point differ by at least a significant bit, then generating a compressed address by combining 
the identified network addresses of the two packets, wherein the length of the compressed 
address is one bit less than the combined network addresses. 

Claim 7 (original) The method of claim 2, further comprising the step of generating flow 
information at the first point based on the matched destination address and the identified 
source address. 
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Claim S (original) The method of claim 7, further comprising the step of sending the flow 
information generated at the first point to the second point. 

Claim 9 (currently amended) The method of claim 8, further comprising updating the flow 
information at the first and second point points when a new destination address is identified 
at the second point. 

Claim 10 (currently amended) The method of claim 8, further comprising the step of 
updating the flow information at the first and second point points when a destination address 
is purged at the second point after a pre-determined time-out period. 

Claim 1 1 (currently amended) A method for deterrmning a direction of flow of data between 
a source and a destination network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the network; 

selecting a time-to-live value from the plurality of packets identified at the first point 
and at least one of the plurality of packets identified at the second point; 

comparing a destination address of each packet identified at the first point with a 
destination address of one or more packets identified at the second point; and 

if one of the compared destination addresses matches, then identifying a source 
address of the corresponding packet identified at the first point, associating the identified 
source address and the matching destination address to a flow between the source and 
destination, and comparing the time^to-live value values of the packets identified at the 
first point and the at least one of the plurality of packets identified at the second point 
corresponding to the flow between the source and the destination to determine the direction 
of flow between the source and the destination. 

Claim 12 (currently amended) A method for determining a direction of flow of data between 
a source and a destination in a network, said method comprising the steps of: 

identifying a plurality of packets at a first point and a second point in the network; 

selecting a time-to-live value from at least one of the plurality of packets identified at 
the first point and at least One of the plurality of packets identified at the second point; 

comparing a source address of each packet identified at the second point with a 
source address of one or more packets identified at the first point; ttid 

if one of the compared source addresses matches, then identifying a destination 
address of the corresponding packet identified at the second point, and associating the 
identified destination address and the matching source address to a flow between the source 
and destination, and comparing the time-to-live v aluo values of the packets identified at the 
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first point and the at Jeast one of the plurality of packets identified at the second point 
corresponding to the flow between the source and destination to determine the direction of 
the flow between the source and the destination. 

Claim 13 (currently amended) A system for identifying a flow of data between a source and 
a destination in a network, comprising: 

a first processor that identifies a destination address of one or more packets flowing 
through a second point in the network and sends the compress e d destination address to a 
first point in the network; 

a second processor that identifies a destination address of a packet flowing through 
the first point, receives the destination addresses from the first processor, and generates flow 
information based on a comparison between the destination addresses received from the first 
processor and the destination addresses of the packet identified at the second processor, 
wherein the flow information identifies the flow of packets between the first point and the 
second point. 

Claim 14 (currently amended) A system for identifying a flow of data between a source and 
a destination in a network, comprising: 

a first processor that identifies a source address of one or more packets flowing 
through a first point in the network and sends the source addresses to a second point in the 
network; and 

a second processor that identifies a source address of a packet flowing through the 
second point, receives compre s s e d source addresses from the first processor, and generates 
flow information based on a comparison between the source addresses received from the 
* first processor and the source address of the packet identified at the second processor, 
wherein the flow information identifies the flow of packets between the first point and the 
second point. 

Claim 15 (previously added) A method comprising: 
receiving a first set of information; 
receiving a second set of information; 

generating a match value from the first set of information and the second set of 
information; and 

generating a flow entry based upon the match value. 
Claim 16 (previously added) The method of claim 15 wherein; 
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the first set of information comprises a first source address and a first destination 
address; 

the second set of information comprises a second source address and a second 
destination address; 

the match value is based upon the first destination address and the second destination 
address; and 

the flow entry indicates that information is flowing between a first node associated 
with the first set of information and a second node associated with the second set of 
information. 

Claim 17 (previously added) The method of claim 16 wherein: 

the first set of information comprises a first time-to-live value; 

the second set of information comprises a second time-to-live value; and 

the flow entry indicates the direction of information flowing between the first node and 
the second node, the flow entry based upon the first time-to-live value and the second 
time-to-live value. 

Claim 18 (previously added) A method comprising: 

comparing a first destination address with a second destination address to generate a 
match value; and 

generating a flow entry based upon the match value. 

Claim 19 (previously added) The method of claim 18 wherein the flow entry indicates that 
information is flowing between a first node associated with the first destination address and 
a second node associated with the second destination address. 

Claim 20 (previously added) A method comprising: 

comparing a first source address with a second source address to generate a match 
value; and 

generating a flow entry based upon the match value. 

Claim 21 (previously added) The method of claim 20 wherein the flow entry indicates that 
information is flowing between a first node associated with the first source address and a 
second node associated with the second source address. 



-6- 



PAGE 8(15 1 RCVD AT 12/312004 10:14:27 AM [Eastern Standard Time] 1 SVR:USPTO-EFXRF-1/0* DN1S:8729306 1 CSID: 173233631304 T DURATION (mm-ss):05-18 



